-
Notifications
You must be signed in to change notification settings - Fork 30
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Document SBOM ingestion; also mentioned daemon ingestion #168
base: main
Are you sure you want to change the base?
Conversation
Signed-off-by: Ritesh <[email protected]>
✅ Deploy Preview for resonant-wisp-1a517a ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
Signed-off-by: Ritesh <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's off to a good start. As in your other PR, let's add a table of command line options and replace the top line with something like
---
layout: page
title: Ingesting SBOMs into GUAC
permalink: /ingesting-sboms/
---
I suggest renaming the file to sbom-ingestion.md
as well.
guac-SBOM-ingestion.md
Outdated
- You can send SBOMs directly to GUAC using its API. | ||
- Example API request: | ||
```bash | ||
curl -X POST -F "[email protected]" http://guac-server/v0/ingest |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What's the source for this? This does not work on my local GUAC instance.
guac-SBOM-ingestion.md
Outdated
### Recommended Configuration for Daemon Mode | ||
|
||
To use daemon-mode ingestion effectively, ensure the following: | ||
1. **Install and configure** the appropriate collectors (e.g., GCS, GitHub, or local directory collectors). |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The collectors are built-in
guac-SBOM-ingestion.md
Outdated
### Recommended Configuration for Daemon Mode | ||
|
||
To use daemon-mode ingestion effectively, ensure the following: | ||
1. **Install and configure** the appropriate collectors (e.g., GCS, GitHub, or local directory collectors). | ||
2. **Configure polling intervals** to balance between frequency and system load. | ||
3. **Verify connectivity** between GUAC and the data source to avoid ingestion delays. | ||
|
||
Example of starting GUAC in daemon mode: | ||
```bash | ||
guac-server --config /path/to/config.yaml --daemon |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Again, this command is not a binary that we ship. See guacsec/guac#1005 (comment)
guac-SBOM-ingestion.md
Outdated
--- | ||
|
||
### Conclusion | ||
|
||
SBOM ingestion in GUAC supports both **manual and automated** workflows: | ||
- **Manual ingestion** is suited for individual files and testing. | ||
- **Daemon-mode ingestion** allows for **automatic polling** from collectors like GCS. | ||
|
||
With both options available, GUAC can integrate seamlessly into various workflows, from CI/CD pipelines to periodic compliance checks. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This section is unnecessary.
Signed-off-by: Ritesh <[email protected]>
|
Signed-off-by: Ritesh <[email protected]>
sbom-ingestion.md
Outdated
2. **Daemon-Mode Ingestion (Polling Collectors)**: | ||
- When configured, GUAC operates in **daemon mode**, using collectors (like GCS) to poll for new SBOMs at regular intervals. | ||
- **How to Enable Daemon Mode**: | ||
- Set up a configuration file specifying the collector sources. | ||
- Example of a collector config: | ||
```yaml | ||
collectors: | ||
- type: gcs | ||
bucket: my-sbom-bucket | ||
pollingInterval: 5m | ||
``` | ||
- Once activated, GUAC will **automatically fetch and ingest** SBOMs from the specified source. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What's your source for that example collector config? It doesn't line up with the comment I left in the last round of review.
Signed-off-by: Ritesh <[email protected]>
Closes #140
Closes #142